Fix Compromised WordPress Security

My WordPress site is flagging “compromised account login” notices and I have already spotted at least one instance of unauthorized access. I changed all administrator passwords right away, but that is the only measure in place at the moment. The security plugin I had installed was blocking legitimate users, so I removed it and the site is now running with no active protection. I need a specialist who can: • Perform a full security audit, including file-system and database scans, to confirm whether any malware or backdoors were left behind. • Trace and close the point of entry that allowed the unauthorized login. • Clean or replace any infected core, theme, or plugin files without disrupting the live site. • Re-implement a security plugin (Wordfence, Sucuri, iThemes Security, or a comparable tool you trust) and configure it so real users are not locked out. • Harden the server and WordPress settings—correct file permissions, disable XML-RPC if needed, enforce strong passwords, and set up rate-limiting on login attempts. • Provide a short hand-over report outlining what you found, what you fixed, and any follow-up steps I should take. Successful completion means the site passes an external malware scan, login pages are protected yet usable, and no further “compromised account” warnings appear over a 7-day observation window. Access can be granted via cPanel, SSH, and WordPress admin as soon as we agree on the workflow.